1z0-822 Practice Exam Questions with Answers Oracle Solaris 11 Advanced System Administration Certification

The ps command prints information about active processes.

Without options, ps prints information about processes asso-

ciated with the controlling terminal. The output contains

only the process ID, terminal identifier, cumulative execu-

tion time, and the command name. Otherwise, the information

that is displayed is controlled by the options.

C: You cannot activate an unbootable BE in a nested BE.

BE solaris-1 is marked with !R.

Unbootable BEs inside of a nested BE are represented by an exclamation point (!)

BF: BE solaris-1 is marked with !R.

Unbootable BEs inside of a nested BE are represented by an exclamation point (!)

Incorrect:

Not A: BE1 can be activated. It is bootable (not marked with a !)

Not D: Different BEs can be used in the two zones.

Not E: BE solaris-1 is not marked with an N. The Active field indicates whether the boot environment is active now, represented by N

The FX scheduler provides a scheduling policy for processes that require user or application control of scheduling priorities. The priorities of processes that run under FX are fixed.

The FX class provides a fixed-priority preemptive scheduling policy. This policy is used by processes that require user or application control of scheduling priorities but are not dynamically adjusted by the system. By default, the FX class has the same priority range as the TS, IA, and FSS classes. The FX class allows user or application control of scheduling priorities through user priority values assigned to processes within the class. These user priority values determine the scheduling priority of a fixed-priority process relative to other processes within its class.

Incorrect:

Not A: The fair share scheduling class enables you to allocate CPU time based on shares instead of the priority scheme of the timesharing (TS) scheduling class.

Not D: The goal of the time-sharing policy is to provide good response time to interactive processes and good throughput to CPU-bound processes. The scheduler switches CPU allocation often enough to provide good response time, but not so often that the system spends too much time on switching. Time slices are typically a few hundred milliseconds.

The time-sharing policy changes priorities dynamically and assigns time slices of different lengths.

* DiffServ uses the 6-bit Differentiated services Field (DS field) in the IP header for packet classification purposes.

* In the Diffserv model, the marker marks a packet with a value that reflects a forwarding behavior. Marking is the process of placing a value in the packet's header to indicate how to forward the packet to the network. IPQoS contains two marker modules:

/ dscpmk – Marks the DS field in an IP packet header with a numeric value that is called the Differentiated Services codepoint, or DSCP. A Diffserv-aware router can then use the DS codepoint to apply the appropriate forwarding behavior to the packet.

/ dlcosmk – Marks the virtual local area network (VLAN) tag of an Ethernet frame header with a numeric value that is called the user priority. The user priority indicates the class of service (CoS), which defines the appropriate forwarding behavior to be applied to the datagram.

Note:

* Differentiated services or DiffServ is a computer networking architecture that specifies a simple, scalable and coarse-grained mechanism for classifying and managing network traffic and providing quality of service (QoS) on modern IP networks. DiffServ can, for example, be used to provide low-latency to critical network traffic such as voice or streaming media while providing simple best-effort service to non-critical services such as web traffic or file transfers.

* IPQoS, included in Solaris, includes the following modules, which are part of the Differentiated Services (Diffserv) architecture that is defined in RFC 2475:

Classifier

Meter

Marker

IPQoS adds the following enhancements to the Diffserv model:

Flow-accounting module

802.1D datagram marker

Only verbose mode is selected (-v) not checkpoints options.

* You can use the options provided in the distro_const command to stop and restart the build process at various stages in the image-generation process in order to check and debug the image that is being built. This process of stopping and restarting during the build process is called checkpointing. Checkpointing is optional.

Note:

* You can use the options provided in the distro_const command to stop and restart the build process at various stages in the image-generation process, in order to check and debug your selection of files, packages, and scripts for the image that is being built. This process uses the checkpointing options that are available in the distro_const command.

* distro_const Command Options

/ distro_const build manifest

Builds an image in one step using specified manifest file

/ distro_const build -v

Verbose mode

/ distro_const build -l manifest

Lists all valid checkpoints at which you can pause and resume building an image

/ distro_const build -p checkpoint_name manifest

Pauses building an image at a specified checkpoint

/ distro_const build -r checkpoint_name manifest

Resumes building an image from a specified checkpoint

/ distro_const build -h

Displays help for the command

* After you have set up the manifest file that you plan to use and, if desired, customized the finalizer scripts, you are ready to build an image by running the distro_const command.

You can use the distro_const command to build an image in either of the following:

In one step

Pausing and restarting the build as needed to examine the content of the image and debug the scripts during the build process

Note:

You might want a local IPS repository for the following reasons:

Performance and security. You do not want your client systems to go to the Internet to retrieve new software packages or update existing packages.

Replication. You want to ensure that you can perform the same installation next year that you perform today.

Custom packages. You want to include your own IPS package in the same repository with Oracle Solaris OS packages.

See steps 7 and 8 below.

How to Re-create a ZFS Root Pool and Restore Root Pool Snapshots

1. Boot from an installation DVD or the network.

2. Mount the remote snapshot file system if you have sent the root pool snapshots as a file to the remote system.

3. If the root pool disk is replaced and does not contain a disk label that is usable by ZFS, you must relabel the disk.

4. Re-create the root pool.

5. Restore the root pool snapshots.

6. Verify that the root pool datasets are restored.

7. Set the bootfs property on the root pool BE.

8. Install the boot blocks on the new disk.

9. Reboot the system.

* policy.conf

policy.conf– configuration file for security policy.

The policy.conf file provides the security policy configuration for user-level attributes.

* Example: Modifying Every User's Basic Privilege Set

In this example, the security administrator of a large Sun Ray installation does not want regular users to view the processes of other Sun Ray users. Therefore, on every system that is configured with Trusted Extensions, the root role removes proc_info from the basic set of privileges. The PRIV_DEFAULT setting in the /etc/policy.conf file is uncommented and modified as follows:

PRIV_DEFAULT=basic,!proc_info

* -p pattern

Set the per-process core file name pattern to pattern for each of the specified process-IDs. The pattern can contain any of the special % variables

* Variables:

%f, executable file name, up to a maximum of MAXCOMLEN characters

%p, process-ID

* Example. The core file name pattern:

/var/core/core.%f.%p

would result, for command foo with process-ID 1234, in the core file name: /var/core/core.foo.1234

* Example. Setting the core file name pattern

When executed from a user's $HOME/.profile or $HOME/.login, the following command sets the core file name pattern for all processes run during the login session:

example$ coreadm -p core.%f.%p $$

$$ is the process-id of the currently running shell. The per-process core file name pattern is inherited by all child processes.

Note (see synopsis 2 below).

* The coreadm command is used to specify the name and location of core files produced by abnormally-terminating processes.

SYNOPSIS

coreadm [-g pattern] [-i pattern] [-d option...] [-e option...]

coreadm [-p pattern] [pid...]

coreadm –u

The first form shown in the synopsis can be executed only by the super-user and is used to configure system-wide core file options, including a global core file name pattern and a per-process core file name pattern for the init(1M) process.

The second form can be executed by non-privileged users and is used to specify the file name pattern to be used by the operating system when generating a per-process core file.

create uses a default template of SYSdefault. The default template can be changed on a system-wide basis using the default_template SMF property of the svc:/system/zones:default service.

Note:

create [-F] [ -a path |-b | -t template]

Create an in-memory configuration for the specified zone. Use create to begin to configure a new zone

How to Specify a Temporary Resource Cap for a Zone

This procedure is use to allocate the maximum amount of memory that can be consumed by a specified zone. This value lasts only until the next reboot. To set a persistent cap, use the zonecfg command.

1. Become superuser, or assume a role that includes the Process Management profile.

The System Administrator role includes the Process Management profile.

2. Set a maximum memory value of 512 Mbytes for the zone my-zone.

# rcapadm -z testzone -m 512M

Required to maintain high availability --> use a mirror.

The same data will be accessed many times throughout the day. Configure the storage for maximum performance. Use caching.

Gathering Statistics About Network Traffic on Flows

Flow statistics help you evaluate packet traffic on any defined flows on the system. To obtain flow information, you use the flowstat command.

* Display statistics about incoming and outgoing packets on all flows.

# flowstat

This command provides a static display of traffic information on all configured flows.

Incorrect:

Not A: In computing, sar (System Activity Report) is a Solaris-derived system monitor command used to report on various system loads, including CPU activity, memory/paging, device load, network.

Adding privileges must be performed the global zone administrator by using zonecfg(1M). While adding this functionality, we also added the ability to remove privileges from a zone's limit set.

svcs -x: Explains why a service is not available.

Incorrect:

not A: svcs -l FMRI: Provides a long listing of information about FMRI; includes dependency information

not B, not C: svcs -d FMRI: Lists dependencies for FMRI.

not e: svcadm clear FMRI: Clear faults for FMRI.

A: Configure pkg.depotd to provide remote access. pkg.depotd provides an HTTP interface to a pkg repo. Here we are going to make the repo server listen on port 10000, and use the repo dir we created as its default.

# svcadm disable pkg/server

# svccfg -s pkg/server setprop pkg/inst_root = /data/myrepo

# svccfg -s pkg/server setprop pkg/port = 10000

# svcadm refresh pkg/server

# svcadm enable pkg/server

B: Set-Publisher

With -G (--remove-origin), remove the URI or path from the list of origins for the given publisher. The special value * can be used to remove all origins.

Incorrect:

Not D: unset-publisher publisher ...

Remove the configuration associated with the given publisher or publisher

Not E: set-publisher

Update an existing publisher or add a package publisher. If no options affecting search order are specified, new publishers are appended to the search order and are thus searched last.

Global Actions on Resource Control Values

Global actions apply to resource control values for every resource control on the system. You can use the rctladm command to perform the following actions:

* Display the global state of active system resource controls

* Set global logging actions

Global Monitoring of Resource Control Events

Often, the resource consumption of processes is unknown. To get more information, try using the global resource control actions that are available with the rctladm command. Use rctladm to establish a syslog action on a resource control. Then, if any entity managed by that resource control encounters a threshold value, a system message is logged at the configured logging level.

Scheduling classes provide different CPU access characteristics to threads that are based on algorithmic logic. The scheduling classes include:

Realtime scheduling class (RT) (not a)

Interactive scheduling class (IA)

Fixed priority scheduling class (FX) (not b)

Timesharing scheduling class (TS) (not c)

Fair share scheduling class (FSS) (not E)

* Syntax:

priocntl -s [-c class] [class-specific options]

[-i idtype] [idlist]

* The priocntl command displays or sets scheduling parameters of the specified process(es). It can also be used to display the current configuration information for the system's process scheduler or execute a command with specified scheduling parameters.

Processes fall into distinct classes with a separate scheduling policy applied to each class. The process classes currently supported are the real-time class, time-sharing class, interactive class, fair-share class, and the fixed priority class.

* priocntl options include:

-c

class

Specifies the class to be set. (The valid class arguments are RT for real-time, TS for time-sharing, IA for inter-active, FSS for fair-share, or FX for fixed-priority.) If the specified class is not already configured, it is automatically configured.

-s

Sets the scheduling parameters associated with a set of processes.

re

page reclaims.

The information is given in units per second.

Note:

* vmstat reports virtual memory statistics regarding kernel thread, virtual memory, disk, trap, and CPU activity.

Incorrect:

Not B: sr, pages scanned by clock algorithm

Not C: free

size of the free list (Kbytes)

Not D: fr

kilobytes freed

Example. Displaying Administratively Customized Properties (here only admin layer is displayed with –l)

The following command uses SMF layers to display administratively customized properties.

example% svcprop -p config -l admin svc:/network/dns/client

(A) config/domain astring admin my.domain.com

(D) config/nameserver net_address admin 10.22.33.44 10.44.33.11

Note:

* config/nameserver refers to the Solaris DNS server.

/ The nameserver keyword specifies DNS servers to query using IP address.

Example:

The /etc/resolv.conf file contains configuration directives for the DNS resolver. The following resolv.conf example shows two name servers and three search suffixes:

domain nj.bigcorporation.com

nameserver 192.168.10.11

nameserver 192.168.20.88

* The svcprop utility prints values of properties in the service configuration repository. Properties are selected by -p options and the operands

Create the NFS share.

# zfs set share=name=fs1,path=/fs1,

prot=nfs tank/fs1

Set the sharenfs property to on.

# zfs set sharenfs=on tank/fs1

Incorrect:

Not A, Not C: The share is not published until the sharenfs or sharesmb property is set to on. For example:

# zfs set sharenfs=on rpool/fs1

# cat /etc/dfs/sharetab

/rpool/fs1 fs1 nfs sec=sys,rw

Not B: First create the share, then set the sharenfs to on.

Note:

When you create a NFS share of a ZFS file system, you must provide the following share components:

share=name

Identify a name for your share. Maximum share name is 80 characters.

path=pathname

Identify a path for your NFS share that must exist within the file system or directory to be shared.

prot=nfs or smb

Identify the protocol as NFS or SMB.

pool/filesystem

Identifies the ZFS file system to be shared.

Additional share options include:

rw= or ro=

Identifies whether the share is available as read/write or read-only to all clients. You can also specify a colon-separated list that includes hostnames, IP addresses, or a netgroup.

* The netcfg command manipulates system network configuration profiles. The netcfg command can be invoked interactively, with an individual subcommand, or by specifying a command file that contains a series of subcommands.

* subcommand: netcfg commit

Commits the current profile specification to persistent storage. A configuration must be correct to be committed. Therefore, this operation automatically performs a verify operation on the profile or object as well. The commit operation is attempted automatically upon exiting the current scope by using either the end or exit subcommand.

Note:

* from the netadm list output we see the line

ncp Automatic disabled

* Oracle Solaris 11 uses profile-based network configuration, which is comprised of two network configuration modes: manual (fixed) and automatic (reactive). Depending on which network configuration mode you choose during an installation, either the DefaultFixed network configuration profile (NCP) or the Automatic NCP is activated on the system. If the DefaultFixed NCP is active, the network is manually configured by using the dladm and ipadm commands . If the Automatic NCP or a user-defined NCP that you previously created is active, the netcfg and netadm commands (formerly nwamcfg and nwamadm) are used to create and manage network configuration.

vmstat reports virtual memory statistics regarding kernel thread, virtual memory, disk, trap, and CPU activity.

Incorrect:

Not B: You cannot activate an unbootable BE in a nested BE.

Not D: The zone is named ozone (not ozone2).

Note:

* beadm supports the concept of a nested BE, specifically, as it pertains to BEs for non-global zones.

* beadm list [-a | -ds] [-H] [beName]

Lists information about the existing boot environment named beName, or lists information for all boot environments if beName is not provided. The Active field indicates whether the boot environment is active now, represented by N; active on reboot, represented by R; or both, represented by NR. Unbootable BEs inside of a nested BE are represented by an exclamation point (!)

The beadm utility enables you to create a new boot environment based on an existing snapshot.

Note:

* You can manage the boot environments on your system either by using the beadm command or by using the Package Manager.

* A boot environment is a bootable instance of the Oracle Solaris operating system image plus any other application software packages installed into that image. System administrators can maintain multiple boot environments on their systems, and each boot environment can have different software versions installed.

prctl

- get or set the resource controls of running processes, tasks, and projects.

The prctl utility allows the examination and modification of the resource controls associated with an active process, task, or project on the system. It allows access to the basic and privileged limits and the current usage on the specified entity.

Incorrect:

not A: ipcs provides information on the ipc facilities for which the calling process has read access.

not D:

rctladm

- display or modify global state of system resource controls

Not E: prstat - report active process statistics

Note:

* In the Oracle Solaris operating system, the concept of a per-process resource limit has been extended to the task and project entities.

Signature Policy: verify

Verify that all manifests with signatures are validly signed, but do not require all installed packages to be signed.

This is the default value.

* zone.max-processes

Maximum number of process table slots

simultaneously available to this zone.

Because both normal processes and

zombie processes take up process table

slots, the max-processes control thus

protects against zombies exhausting the

process table. Because zombie processes

do not have any LWPs by definition, the

max-lwps control cannot protect against

this possibility

Note:

* prctl - operations on a process

Use the prctl command to make runtime interrogations of and modifications to the resource controls associated with an active process, task, or project on the system.

Example:

In Solaris 11 the “grant” authorization is no longer used, rather a set of authentication have been defined for that

purpose. The authentication strings can be found in /etc/security/prof_attr.d/core-os file.

solaris.auth.:RO::Authorizations::help=AuthorizationHeader.html

solaris.auth.assign:RO::Assign any authorization::help=AuthAssign.html

solaris.auth.delegate:RO::Assign owned authorizations::help=AuthDelegate.html

solaris.auth.manage:RO::Manage authorizations::help=AuthManage.html

Note: You no longer need to use the visual editor to add your own site specific entries to the Role Based Access Controls framework in Oracle Solaris 11. The profile command has been modified to support creation, modification and removal of Rights Profiles

Disabled in the MODE column means that all probe-based failure detection is disabled.

You must enable transitive probing to use this failure detection method that does not require test addresses.

Note:

* ipmpstat

- display IPMP subsystem status

The ipmpstat command concisely displays information about the IPMP subsystem.

The -t option identifies the probe targets that are associated with each IP interface in an IPMP group.

* Target mode displays IPMP probe target information. The following output fields are supported:

/ INTERFACE

The IP interface name associated with the information.

/ MODE

The probe target discovery mode:

routes

Probe targets found by means of the routing table.

multicast

Probe targets found by means of multicast ICMP probes.

disabled

All probe-based failure detection is disabled.

transitive

Failure detection is by means of transitive probing, where the health of the IP interface is determined by probing other active interfaces in the group.

/ TESTADDR

The source address used in outgoing probes. Active interfaces that are being used for data traffic, as well as interfaces that have been explicitly configured with NOFAILOVER test addresses, will have the hostname (or IP address) that is used for sending and receiving the ICMP probes. All other interfaces in the group will display the name of the interface from which the probes are sent. Note that if an active IP interface is configured with both IPv4 and IPv6 test addresses, probe target information will be displayed separately for each test address.

/ TARGETS

A space-separated list of probe target hostnames (or IP addresses) for ICMP probes, or target interfaces for transitive probes. The IP targets will be listed in firing order, and, if no probe targets could be found, this field will be empty.

* The following directives cause audit_binfile.so to be loaded, specify the directories for writing audit logs, and specify the percentage of required free space per directory.

auditconfig -setplugin audit_binfile active \

"p_dir=/var/audit/jedgar/eggplant,/var/audit/jedgar.aux/eggplant,

/var/audit/global/eggplant;p_minfree=20;p_fsize=4.5GB"

* The attributes specifying the configuration of audit_binfile plugin include:

p_dir

dir1[,dir2],.. [,dirn]

A list of directories, where the audit files will be created. Any valid writable directory can be specified.

p_fsize

The p_fsize attribute defines the maximum size that an audit file can become before it is automatically closed and a new audit file is opened. This is equivalent to an administrator issuing an audit -ncommand when the audit file size equals the value specified by the administrator. The default size is zero (0), which allows the file to grow without bound.

Interface mode displays the state of all IP interfaces (IP links) that are tracked by in.mpathd on the system.

Incorrect:

Not A: Address mode displays the state of all IPMP data addresses on the system.

Not B: Group mode displays the state of all IPMP groups on the system.

Not D: Probe mode displays information about the probes being sent by in.mpathd.

Not E: Target mode displays IPMP probe target information.

From the poolcfg –c info command output we see that FSS (Fair Share Scheduler) is used.

From the prctl command output we see that zone z1 has been configured with a zone.cpu-shares value of 40.

* The pool_default has a value of 100 CPU shares.

* prstat

- report active process statistics

Option –Z

-Z

Report information about processes and zones. In this mode, prstat displays separate reports about processes and zones at the same time.